Amanda Smith was at home in upstate Pennsylvania when police arrived with a warrant for her arrest over a crime committed in Arkansas — a state she has never visited. The charge: a $1,000 scam on Facebook Marketplace funneled through a Cash App account bearing her name. Smith had never used Cash App. A criminal had opened the account using her stolen Social Security number and date of birth, collected the money, and dispersed it across a network of other accounts within hours. Smith spent three nights in jail. Her initial bail was set at $50,000, but authorities told her paying it was pointless because they planned to extradite her to Arkansas anyway. After release, she and her husband drove over a thousand miles to Arkansas for a court appearance, where she was fingerprinted, photographed, and hit with another $20,000 bail. She now faces up to six years in prison on charges including computer fraud, unlawful use of a communication device, and theft of property. The investigative trail is riddled with discrepancies that should have flagged the account as fraudulent before charges were ever filed. The address on the Cash App account was one where neither Smith nor her husband had ever lived. The account was accessed through Verizon connections; Smith uses AT&T and has never had a Verizon plan. The phone used to create the account was running iOS 16.1.1, a 2022-era operating system, while Smith's iPhone 13 mini was running iOS 26.5.2. The phone number linked to the account had appeared in historical data breaches tied to Smith's name — and someone had used that same number to create a Venmo account under a different name roughly a week before the fraudulent Cash App account was opened. Cash App's response compounded the damage. When Smith tried to obtain records about the account opened in her name, the company refused — because she couldn't prove she was the owner. The Kafkaesque logic: an identity theft victim cannot access the fraudulent account created with her stolen identity because she doesn't control it. Smith eventually obtained the data through legal discovery in her criminal case, but only after months of fighting charges that never should have been filed. Police used a search warrant to get Smith's personal details from Cash App, then matched them against a LexisNexis Accurint database. Having someone's name and SSN on an account was apparently treated as sufficient to establish criminal responsibility, despite no evidence that Smith operated the account, accessed it, or received any funds. The detective's investigation stopped at identity matching and never established control. Prosecutors have offered Smith a plea deal: a $1,000 fine, $1,000 in restitution, and three years' probation. She has refused, maintaining her innocence. A hearing is scheduled for November. Her private investigator has questioned whether police ever established that she actually controlled the account. Her lawyer is working to have the case dismissed. Neither Cash App nor the prosecutor responded to requests for comment. This case exposes a systemic failure at every layer. Fintech companies can open accounts with stolen identities and bear no liability when those accounts are used for fraud. Law enforcement equates identity data with criminal intent. The burden of proof quietly inverts — the accused must demonstrate innocence rather than the state demonstrating guilt. Smith's situation is not unique: a grandmother was recently jailed for six months after facial recognition technology falsely linked her to a bank fraud case and is now suing the City of Fargo for $10 million.
